Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

AnteeoWMS Login Portal Allows Unauthorized Access to Data

CVE-2024-44349 · published 2 years ago
Summary

An attacker can use the login portal to access sensitive data without a password. This is possible because the system doesn't properly check user input. Update to AnteeoWMS version 4.7.34 or later to fix this issue.

Original advisory text
A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data i...
A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data in the underlying DB.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
6% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published8 Oct 2024
Updated19 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-44349 · NVD
Track software like this
Free during beta